Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks. Tracked as CVE-2026-97229, this vulnerability stems from an integer overflow weakness and was discovered in the CI/CD Regular Expression Compiler, which parses and evaluates regular expressions in pipeline configuration files. "GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company explained on October 12 when it released security patches to address the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8.
A new wave of fridge cyberattacks hit supermarket refrigeration systems across five European countries, raising temperatures and causing food losses. A new wave of fridge cyberattacks has affected supermarket refrigeration systems in several European countries. Fridges and freezers suddenly rose in temperature overnight, with some incidents suspected to be caused by hackers. On Monday, November 2, Ahold Delhaize and Colruyt reported an IT incident affecting dozens of stores in Belgium and Luxembourg. Swedish supermarket chains ICA and Coop also reported similar problems. “Ahold Delhaize and Colruyt said on Monday that an IT incident overnight hit fridges and freezers in dozens of stores in Belgium and Luxembourg, while Swedish grocers ICA and Coop reported similar temperature spikes, with one store blaming a cyberattack.” Reuters states. BREAKING: Swedish grocery giant ICA, one of Sweden's largest supermarket chains, says several of its stores have been hit by a cyberattack overnight, causing refrigerators and freezers to be remotely set to 50°C. The incident has likely resulted in large quantities of food… pic.twitter.com/wrcmGHw1qV — GeoInsider (@InsiderGeo) November 2, 2026 “Problems were discovered at several grocery stores in Sweden overnight Monday.” reported Sweden Herald. “We are aware that a limited number of stores were affected by an incident overnight that affected their refrigeration and freezer systems. Ica is providing support in handling the incident, Ica Group press officer Gustaf Nilsson tells TT.” The latest incidents follow a similar wave of fridge cyberattacks in France last month. In mid-October, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed. The attackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold. Fresh and frozen stock was destroyed, and the Paris prosecutor says there were also fires. The method is simple and nasty. Refrigeration systems have a forced defrost function that clears ice buildup, and the attackers appear to have triggered it remotely in a continuous mode, with a temperature setting of 50 degrees. The equipment heated for several hours instead of keeping goods cold, and when staff opened the fridges and freezers in the morning, a sector source told BFM, “a wave of heat” came out. The attack caused fires and food losses. However, cybersecurity consultant Emil Olofsson of Integrity 360 told Swedish news agency TT that temperatures reached 80°C in some cases and several units caught fire. This figure differs from the one reported by police. ICA Kvantum in Sjöbo said on Facebook that a cyberattack caused the refrigeration problems. ICA Hägerstensåsen in Stockholm was also reportedly affected. According to the Sjöbo store, the temperature inside its fridges and freezers rose to 50°C. In Belgium, Delhaize detected unusual temperature increases in its refrigeration systems on Monday. Spokesperson Sarah De Meester said the company is investigating the incident. Stephan Moelans, CEO of Sabcobel, the company that manages Delhaize’s refrigeration systems, told news agency Belga that hackers had switched the units’ evaporators to defrost mode. His office declined to comment to Reuters. Colruyt Group, which operates Spar stores in Belgium through a franchise system, said five stores had suffered attacks on their refrigeration systems. Meanwhile, Belgian newspaper Le Soir reported that dozens of Delhaize and Carrefour stores were affected. UPDATE: REFRIGERATION DISRUPTIONS SPREAD ACROSS EUROPE – SWEDEN AND BELGIUM AFFECTED IN SWEDEN: • At least 6 ICA supermarkets affected by suspected refrigeration system hacks. • Coop has now CONFIRMED that 6 of its stores in central Sweden are also affected. • Freezer… https://t.co/a3oGMrGdmz pic.twitter.com/8Q3CFDDLhT — Coffe Report (@CoffeReport) November 2, 2026 It follows a similar attack in France last month. Police said hackers seized control of the cooling units at hundreds of supermarkets and raised temperatures as high as 50 degrees Celsius (122 Fahrenheit), which caused fires and food losses. Cybersecurity consultant Emil Olofsson of Integrity 360 told TT, Sweden’s news agency, that temperatures there reached 80 degrees and some units caught fire, a figure that differs from the police number. In Belgium, Delhaize noticed temperature increases in its cooling systems on Monday, spokesperson Sarah De Meester said, and the company is investigating. Stephan Moelans, CEO of the refrigeration firm Sabcobel, which runs Delhaize’s systems, told the news agency Belga it was a cyberattack that switched the units’ evaporators to defrost mode. His office declined to comment to Reuters. Colruyt Group, which runs Spar stores in Belgium under a franchise system, said five shops had their fridge systems attacked, and Le Soir reported that dozens of Delhaize and Carrefour stores were affected. Ahold also reported a cybersecurity incident to Dutch police last month, after it detected suspicious activity in its infrastructure. Nothing in the reporting ties that report to Monday’s incident. Fridges and freezers at dozens of supermarkets in Belgium and Sweden overheated overnight in a suspected cyberattack, similar to the one that hit French stores three weeks ago. Delhaize calls it an "IT incident." Delhaize said about 40 of its Belgian stores were affected… pic.twitter.com/qzw6uDybWb — The Informant (@theinformant_x) November 2, 2026 In Sweden, John Billow, head of the national cybersecurity centre, told Reuters his team was working on several incidents involving refrigeration systems in grocery stores around the country. An ICA Kvantum store in Sjöbo said on Facebook that a cyberattack caused its problems, and an ICA store told its followers that its temperatures had been “hacked” overnight and set to 50 degrees. Fifty degrees is fine for a beach and poor for ice cream. That store later said it had opened. At ICA Baronen in Stockholm, a notice said all the freezers were broken because of a cyberattack. The sales manager said the attack came at 2 a.m. and staff noticed it at 5:30 a.m. ICA Hägerstensåsen in Stockholm was reportedly hit too. ICA said only a limited number of stores were affected and that it is helping them deal with the incident. However, press officer Gustaf Nilsson did not say how many stores were involved. Coop told Swedish news agencies Aftonbladet and TT that six stores in central Sweden had similar problems. Press manager Carlos Cancino said it was still unclear whether any food would need to be thrown away or whether the refrigeration units had simply stopped working or had switched to heating mode. He also did not rule out further incidents affecting other stores. An Estonian supermarket chain was also affected. Its refrigeration systems were reportedly set to 50°C, technology provider Kitman Coldtech told public broadcaster ERR. CEO Jann Mutso did not reveal the name of the supermarket chain, saying: “This is very recent. It happened this morning.” How did the attackers get in? In France, Olofsson says they obtained login details for the control systems, which were exposed directly to the internet. He says the attack targeted a product that controls the cooling systems and that the hack isn’t very complicated, so amateurs may have carried it out. Billow says Swedish authorities have noticed in recent weeks that quite a lot of exposed operational technology devices exist in Sweden, and they’ve been clear that these must be updated or patched. Refrigerators and heating systems, security cameras and alarm networks were once largely mechanical, and now they can be monitored and controlled remotely. That gives cybercriminals new openings. Authorities haven’t said who was behind last month’s incidents, and nobody has claimed responsibility. The Sweden Herald reported that the cause of the attacks on Swedish supermarkets remains unknown. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, fridge cyberattacks)
Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. The company urged users to enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices to the latest version to protect their data. "Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. These attacks aim to encrypt data and extort ransom," it said in a Thursday advisory. "Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems. Synology also recommends enabling automatic updates to keep DSM up to date at all times." A Synology spokesperson was not immediately available when BleepingComputer reached out for more information on these C3RB3r ransomware attacks.
Hackers reportedly hit Ukraine ‘s and Russia ‘s emergency alert apps, sending fake nuclear and attack warnings and raising concerns over public safety. Ukraine and Russia both said on Sunday night that hackers had compromised their emergency alert apps and used them to send fake warnings about air raids and other attacks, including nuclear threats. The BBC reported the incident, but neither side’s claims have been independently confirmed. Shortly before 11 p.m. local time (9 p.m. GMT), Ukraine’s widely used Air Alarm app sent the highest-level air raid warnings across the country. Some people, including residents of Kyiv, also received alerts about possible radiation, chemical attacks and street fighting. A message posted on Telegram said the app had likely been targeted by a cyberattack, confirmed there was no radiation threat and urged people to remain calm. “Shortly before 23:00 local time (21:00 GMT), Ukraine’s widely usedair raid app sent red-level air raid warnings nation-wide, with additional warnings of radiation, chemical attacks, and street fighting sent to some residents in areas including Kyiv.” reports BBC. “The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel.” an alert on Telegram read. The false alerts started at about 22:47 with a message that a radiation threat had been declared in Kyiv. At 22:48 came a message in Russian saying a nuclear alert would cover all of Ukraine and not to worry because “it’s Oreshnik flying”. Oreshnik is a Russian intermediate-range ballistic missile that can carry nuclear or conventional warheads, and Russia has the world’s biggest nuclear arsenal, with President Vladimir Putin repeatedly hinting he’s open to using every weapon available. Two more alerts arrived at 22:49. One, in Ukrainian, warned of a chemical attack on Kyiv and told people not to go outside, and the other said street fighting was taking place in the city. Red, orange and green messages reached phones, and at 23:53 users got all-clear messages, each declaring one of the Kyiv threats over. A Ukrainian intelligence body, which the BBC calls the Central Intelligence Agency, said there had been a failure in the app and urged people to use other sources of information. It added that the alerts triggered a radiation hazard signal on loudspeakers in the Lviv region, with no real threat. “The Air Alert app is supported by the Ministry of Digital Transformation of Ukraine, and informs users instantly about the beginning and end of defence alerts. The ministry said it temporarily disabled the app for maintenance after it had “apparently been compromised”. states BBC. “While the false alerts were quickly contained, cybersecurity experts suggested it was a new line in apparent Russian cyberattacks.” The temporary shutdown of the Air Alert app also carries significant risks, even if it lasts only a short time. During an outage, users may not receive timely warnings about incoming attacks, leaving them with less time to reach shelters or take protective measures. This is particularly dangerous in a country where missile and drone attacks can happen with little warning. The incident also highlights a difficult security trade-off: disabling a compromised alert system may prevent attackers from spreading false warnings, but it can temporarily remove a critical channel for delivering real emergency information. Any shutdown therefore needs reliable backup channels, such as sirens, official messaging services and other emergency communication systems. Regional leaders tried to calm people. Svitlana Onyshchuk, head of the Ivano-Frankivsk region, said everything was calm, even though the app had shown a red-level alert for her region from 22:50 to 23:57. Natalya Zabolotna, her counterpart in Vinnytsia, confirmed a cyberattack on the app and warned people not to click the link in the message, which could be phishing. Ukraine’s Centre for Countering Disinformation has advice for when the app isn’t working: turn on smartphone notifications, pay attention to sirens, and read only official sources. Oleksander Merezhko, chair of the foreign affairs committee in the Ukrainian parliament and a member of President Zelensky’s Servant of the People party, said the attack caused no panic. Ukrainians, especially in Kyiv, are used to practically non-stop alerts, he told the BBC, and the message in Russian aroused suspicion at once. The attackers picked a language that gave them away. A few hours later, Russia’s ministry of emergency situations said its own app had suffered “a massive cyberattack” that sent fake information to the public. Ukrainian outlet UNN reported that the hack sent fake nuclear threat alerts inside Russia, citing Atesh, a partisan Ukrainian group operating in Russian-held territory. A screenshot Atesh shared on Telegram, described as purported, claimed nuclear warheads mounted on Ukrainian P1-Sun attack drones had been launched at all regions of Russia, opened with a “risk of getting lively” warning and told residents to stock up on three weeks of food and hide. The alert also had profanities. Russia said it was still restoring the app but claimed the hack had not affected its wider alert system. It said people could still receive warnings through sirens, loudspeakers, text messages, TV and radio. The false alerts appeared minutes before a local ceasefire in Ukraine’s Kherson region ended on Sunday night. The truce had allowed civilians to leave Russian-occupied Oleshky. Although the fake warnings were quickly stopped, experts see the attack as a worrying escalation. “I think it’s the first time it’s happened to an official Ukrainian information app, but I suspect it won’t be the last,” Herbert Lin, a senior research scholar for cyber policy and security at Stanford University, told BBC World Service’s Newsday programme. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Ukraine)
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1. Threat actors exploited these two flaws (tracked as CVE-2026-111357 and CVE-2026-118527) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attack surface. CVE-2026-111357 is a high-severity privilege escalation flaw, and CVE-2026-118527 lets authenticated attackers upload files on an unpatched device. When it released patches for CVE-2026-104935 in October, Ivanti urged admins to upgrade as soon as possible since it was aware of "limited exploitation in the wild." "At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered," Ivanti added in an advisory updated on Thursday.
Introduction As part of proactive threat monitoring, Kaspersky’s Cyber Threat Intelligence team identified a malicious campaign involving C2 agents controlled by artificial intelligence. Confirmed victims of the campaign included organizations in the education sector in several countries across Africa and Latin America. CyberStrikeAI played a key role in the post-exploitation phase. This is an open-source framework in which an LLM orchestrator on the command-and-control server plans actions, selects tools, and generates commands, while an implant executes them on compromised hosts. Using CyberStrikeAI, the attackers progressed from reconnaissance to full domain compromise. According to our data, this is one of the first public descriptions of a compromise involving an LLM in the wild. The campaign we discovered clearly illustrates how the role of AI in attackers’ arsenals is evolving: until recently, language models were used primarily during preparatory stages – for writing phishing emails, debugging code, or searching for vulnerabilities. Now, however, they are being embedded into the very core of the attack, automating actions at every stage: payload execution, persistence on the host, discovery, lateral movement, and, finally, data collection and exfiltration. Post-exploitation – the stage that traditionally required manual work by an experienced operator – plays a particularly significant role here. A key feature of the scheme using the CyberStrikeAI framework is that the implant ceases to be a simple tool for executing the operator’s commands. Decisions are distributed across two levels: the operator defines the task in general terms, while the model determines how to execute it – specifically, which commands to send to the host and in what sequence. Thus, the strategic planning remains with the human, while the choice of technical steps is delegated to the model, and the implant executes the model’s decisions. To understand how this scheme works in practice, let’s examine the chain of actions taken by the attackers, as reconstructed by our analysts during the incident investigation. Timeline of the attack Let’s examine the timeline of the attack using an example from one incident within the detected campaign. The first phase follows a standard approach: a human operator gains access to the victim’s infrastructure via a compromised SQL Server (version 16.0.1000), then collects basic information about the host, deploys tools, and conducts network reconnaissance. All of this activity takes nearly a day, followed by a two-week pause. The second phase is fundamentally different. The first step involves deploying the CyberStrikeAI C2 agent, which receives commands from a server-based LLM orchestrator. During the second phase, the agent performs the following: establishing persistence and conducting local reconnaissance within 2 minutes; conducting domain reconnaissance over the next 5 hours; after a brief pause of several days, moving on to the final stage – lateral movement via SMB and WMI, mass credential dumping on hosts, and database export – with the entire operation taking no more than one hour. We’ll discuss these stages in more detail in the next section. Technical details CyberStrikeAI overview CyberStrikeAI is an open-source, modular platform written in Go for automating penetration testing. Its key feature is combining LLM-based attack orchestration and a built-in C2 server with agents (beacons) within a single server process. The entire “intelligent” layer is isolated on the control server. C2 functions (calling reconnaissance and exploitation utilities, managing webshell connections, assigning tasks to agents, and reading results) are available to the model as MCP tools. The implant is a classic C2 agent with no AI functionality – no API keys, no calls to AI service APIs, and no autonomous logic. It periodically polls the listener server via HTTP/S, TCP, or WebSocket, executes shell commands, and interacts with the file system. To the victim, this activity looks like a typical remote-control session, where a server-side LLM orchestrator queues tasks instead of a live operator. The LLM influences how decisions are made, but not how the corresponding commands are delivered to the host. Although CyberStrikeAI is publicly available, specific instances of the framework can be linked to specific attackers or campaigns. Detection and attribution are possible based on the following artifacts: Control panel: Upon launch, a self-signed TLS certificate is generated, with the framework’s name appearing in the issuer and subject fields. The certificate is created in memory at each startup, so the not_before field effectively records the time the process was launched. Accordingly, as with Cobalt Strike, the chronology of restarts can be reconstructed from the scan history. CyberStrikeAI control panel’s self-signed TLS certificate Implant: The build metadata (go version -m) contains a path to the main package, which includes data pointing to the built-in CyberStrikeAI generator – a temporary directory with the build identifier. This path is identical for all payloads, making it a reliable signature. Additionally, the build info field contains version control system metadata, which can be used to compare samples against one another. Authentication: When communicating with the server, the implant sends an X-Implant-Token header with a fixed value in the HTTP request. The token is unique to each C2 server and is embedded into the malicious payload during the build phase; therefore, it serves as both a network indicator and a sign that the samples belong to the same server. HTTP header parameters sent by the implant to the server It should be noted that the implant version does not reflect the server version. The implant can operate for months while the operator updates the server-side components: listener configurations and keys are preserved during updates. In the incidents we detected, we observed the use of a single agent version throughout the entire incident. In such cases, the sample’s build date may indicate the earliest possible deployment date of the CyberStrikeAI infrastructure, but it still does not provide an estimate of the compromise duration. Execution & Privilege Escalation The first malicious commands on the victims’ systems in the campaign under investigation originated from the sqlservr.exe process, indicating the likely initial access vector and the context in which the attackers gained the ability to execute code. It is important to note that the commands marked as having been executed prior to agent installation were executed manually by the attacker specifically within the context of this process. At this stage, we are not yet dealing with automated implant activity, but rather with manual actions by the operator. Before launching the agent on the machines, the attackers checked for its presence using a PowerShell script, from which we can deduce its default deployment paths: C:\Windows\Temp\, C:\Windows\, C:\ProgramData\, C:\Temp. At the same time, the attacker can disguise the agent’s name as that of a legitimate system process. In the example below, it mimics svchost.exe (svchosts.exe) Checking for the presence of the CyberStrikeAI agent on the system Delivery and execution of the CyberStrikeAI agent Like most C2 agents for Windows, CyberStrikeAI uses PowerShell to execute its payload. When a request is received from the operator, the commands to be executed are additionally encoded in Base64 to bypass keyword-based detection. Decoded form of the command: When administrative privileges were available (for example, a domain administrator account), instead of executing commands directly, the agent on remote hosts often created scheduled tasks so that the malicious payload would run with SYSTEM privileges: An alternative method that does not use schtasks utility is to create a task via the Schedule.Service COM object: The payload (p1.ps1) from the example above is a reverse shell that connects to the server at 185.186.245[.]144:5501: The p1.ps1 payload and similar scripts were distributed across the network using shared network administrative folders and the WMI protocol, which we will describe in more detail in the Lateral Movement section. Stealth In addition to encoding commands in Base64 and obfuscating SQL/LDAP queries – which we will describe in the Collection & Exfiltration and Discovery sections, respectively – the attackers split the malicious payload into multiple files. It is noteworthy that the scripts were transmitted in this manner even before the agent was installed – that is, at a stage where human intervention is typically required – yet they clearly bear the hallmarks of being generated by an LLM. Below is a sequential record of several script fragments written to the file d3.b64. Subsequently, the attackers used the certutil utility to decode the resulting file and executed it with the following command: Once assembled and decoded, the script’s contents looked like this: The script is a tool for decrypting DPAPI secrets from the file C:\ProgramData\dsn_line.txt. This file, in turn, is populated by the following command, which searches for a DSN string containing connection settings in the SQL Server Reporting Services configuration file rsreportserver.config and copies its contents to dsn_line.txt. It is worth noting that some of the scripts delivered and executed as described above contain comments in Chinese (## – researcher’s comments). Persistence If the CyberStrikeAI implant was successfully delivered, the first step was to establish persistence on the target system. To do this, the agent created a scheduled task named SystemUpdate, which specified the path to the implant as the action to be performed: Analysis of the framework’s source code revealed an alternative method of persistence: by adding a value to the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, where the name of the created value matches the task name (SystemUpdate). Agent persistence on Linux systems is also implemented in two ways – by adding the entry @reboot <path_to_beacon> & to the user’s crontab (in which case the process runs at system startup), or by adding the line (nohup <path_to_beacon> &>/dev/null &) to ~/.bashrc (in which case the agent starts when an interactive bash shell is opened). It is worth noting that the choice of a specific persistence method is delegated to the LLM connected to CyberStrikeAI. However, thanks to the human-in-the-loop (HITL) mechanism, the operator retains full control over the process: commands generated by the model may require manual approval or correction before they are executed. Discovery Local Discovery Before installing the agent on a compromised host, the attackers manually gathered basic system information using a fairly trivial set of commands: The attackers also manually checked for internet access and obtained the external IP addresses of the compromised machines using the Chinese service dnslog[.]cn. The service generates a random third-level domain, after which the attackers attempt to resolve it on the compromised machine. If the machine has internet access, the request succeeds, and the attackers obtain the external IP address of the compromised device on the service’s page. For reconnaissance purposes, the agent generates a more complex script designed to map out a path for further privilege escalation by compromising SCCM or exploiting msiexec (the AlwaysInstallElevated key): Additionally, to find ways to elevate privileges locally, the agent executed scripts to inventory services running under domain accounts and tasks running under the SYSTEM account: During their activity, the attackers periodically checked for Microsoft Defender detections: Remote Discovery After gathering information about the compromised host, the attackers proceeded to conduct reconnaissance within the network. During the preparatory phase of the attack, they manually collected additional information about remote hosts using the net.exe utility. During the main phase, the agent used PowerShell’s built-in functionality to detect accessible hosts without relying on additional utilities (such as nmap or fscan): Additionally, relevant LDAP queries to Active Directory objects helped build a network map: Furthermore, the presence of the installed agent on remote hosts was verified using WMI: Domain Discovery The next step was to gather information about the victims’ domains. To this end, before installing the agent, the attackers used standard OS utilities: However, later on, using the CyberStrikeAI implant, reconnaissance was carried out via generated PowerShell scripts: In addition to basic domain information, the agent performed LDAP queries to gather information for Kerberoasting and AS-REP Roasting attacks: Finally, the agent was used to check the domain for the presence of LAPS and Microsoft Azure: To detect signs of Microsoft Azure usage within the infrastructure, the attackers also searched for the .azcopy directory – created by the AzCopy (Microsoft Azure Storage Copy) utility – in users’ home directories: Credential Access After successfully conducting reconnaissance and mapping the network, the attackers moved on to the next stage – dumping credentials. For this purpose, the agent used a classic set of LOLBINs and well-known third-party tools. The agent dumped registry hives containing credentials using the reg.exe utility: The agent dumped the lsass.exe process using the MiniDump function of the comsvcs.dll library. In doing so, the target process’s PID was used instead of its name to make static detection based on the command line more difficult: After successfully compromising privileged domain accounts (specifically, the built-in domain administrator), the attackers also carried out DCSync and Golden Ticket attacks via the agent using a renamed version of the mimikatz utility: Lateral Movement To spread across the network using compromised accounts, the attackers employed utilities from the Impacket toolkit, specifically WMIExec, as indicated by the utility’s characteristic command line: Once installed, the agent prefers to use standard OS mechanisms, such as shared network folders. Another method the agent uses to remotely execute commands is the WMI protocol. In particular, the agent used it to distribute the aforementioned p1.ps1 reverse shell script. This involved using compromised user accounts with local administrator privileges on the target hosts: A second method of lateral movement via WMI uses the Invoke-CimMethod cmdlet: Command & Control To deliver the aforementioned tools (malicious scripts, mimikatz, and the agent itself) to the initial nodes in the infection chain, the attackers used standard OS utilities: After the agent is installed, it checks the availability of the C2 server’s ports. The implementation mechanisms here are virtually unlimited and depend on the “creativity” of the respective LLM agents connected to the server: To download additional utilities, the CyberStrikeAI implant also used built-in utilities (LOLBINs). The tools could be hosted on the attackers’ own servers or downloaded directly from GitHub: Collection & Exfiltration The data collection phase deserves special attention. It demonstrates yet another capability of LLM orchestration – the automatic generation of SQL and LDAP queries tailored to a specific task. In one incident during the campaign, the attackers deployed the CyberStrikeAI implant on an educational organization’s SQL server and collected information from the database via PowerShell. Here is an example of a command executed by the agent: Normalized view of the executed script with comments: Before accessing the data, the agent checked the privileges of the account under which it connected to the database: In decoded form, the check looks as follows: On network resources, file collection was preceded by a recursive directory scan to identify files of interest. To interact with the file system, the implant provides a built-in interface that supports direct uploading and downloading of files. Files are transferred directly via the main encrypted communication channel with the C2 server (HTTP or TCP), and the data itself is encoded in Base64 and packaged into the agent’s standard JSON responses. Another built-in capability of the implant is taking screenshots of the infected machine. As with other actions, the implant does not initiate this on its own: the command to capture the screen is issued by the LLM orchestrator, and the agent merely executes it and returns the result via the same control channel. On Windows, the command for taking screenshots looks like this: The Linux version looks like this: In the incidents we detected, data collection was the final stage of the attack: the chain ended there, and we observed no further activity. Attribution The key artifact for attribution in this campaign is the implant’s build metadata. The attackers built the malicious payload inside a Git clone of the project, so the Go compiler embedded version control system information into the binary files – the hash and commit time, as well as the vcs.modified=true flag (analogous to the +dirty suffix) – indicating uncommitted local changes in the working copy. The combination of these fields forms a unique fingerprint for a specific build. Based on this fingerprint, the samples are divided into two independent groups, in each of which the Windows implant and the Linux implant have completely identical build metadata. A match indicates that, within each group, both payloads were built from the same project working copy. Identical build metadata for the Windows and Linux implant samples, indicating a shared build environment However, these groups do not overlap with one another. They do not share a common C2 infrastructure, and different versions of CyberStrikeAI are deployed on the command-and-control servers. In other words, the build metadata reliably links the samples within each group but does not provide grounds for linking the two groups together. Differences in CyberStrikeAI versions on the command-and-control servers The available data does not allow us to link the activity to any known group of attackers, nor to state with certainty that the same operator is behind both campaigns. Two factors prevent this. First, the tool’s openness: CyberStrikeAI is publicly available, so different operators could have independently deployed it and assembled malicious payloads under similar conditions. Second, command generation by the model: the “signature” characteristic of a specific operator is largely shaped not by a human but by an LLM. On the one hand, this increases the diversity of commands: the same command, when generated multiple times, can look different. On the other hand, it strips them of their individual characteristics, which reduces the value of behavioral metrics for attribution. However, the Chinese-language comments found in the attackers’ scripts and the use of Chinese services still suggest a connection between the activity and a Chinese-speaking operator. In addition, analysts noted the timing of the control servers’ restarts: since the self-signed TLS certificate is regenerated each time the process starts, its not_before field records the restart time, and most of these restarts occurred during business hours in the UTC+8 time zone. The origin of the tool itself also indirectly points in the same direction: CyberStrikeAI was developed within the Chinese cybersecurity community and is well known there. In summary CyberStrikeAI is a telling – though not unique – example of a shift occurring within the class of C2 frameworks: the LLM orchestrator is no longer merely an add-on to reconnaissance but has become a control layer over post-exploitation. If HexStrike AI and similar tools cover the “find and break” phase, and Sliver/Mythic/Havoc cover the “establish a foothold and control” phase, CyberStrikeAI completes the kill chain: a single server-side process written in Go executes utilities via MCP, handles webshell connections, and assigns tasks to the implant, while the model analyzes the results and decides what to do next. The key takeaway is that the introduction of AI into the attack chain does not yet present fundamentally new challenges for detection. All the “intelligent” work remains on the attacker’s side, while the compromised host is subjected to familiar actions: from reconnaissance via Kerberoasting and AS-REP Roasting to LSASS dumps, DCSync, and the Golden Ticket attacks. This is a typical, well-documented set of domain compromise techniques. The novelty of the attack lies not in the methods themselves, but in the speed and ease with which they were executed: AI orchestration has lowered the skill requirements for the operator, but has not taken the attack beyond what defenders already know and are capable of detecting. The timing is also telling: individual key phases of the activity (such as establishing a foothold, lateral movement, and obtaining credentials) took only a few hours, and the entire attack – from agent deployment to the compromise of domain administrators – was completed within 3–4 days. However, the CyberStrikeAI architecture does not limit users to the scenario described. The same mechanisms allow for the on-demand assembly of more complex chains – including DPAPI secret extraction and attacks on SCCM and Azure IMDS – all of which are within reach of the same group of actors, with a relatively low skill barrier. As the models evolve, the gap between the complexity of orchestration and the level of techniques used will narrow, and the operator’s role will gradually shift from setting tasks to monitoring the model’s actions. Detection by Kaspersky solutions It may seem that attacks using AI agents require the creation of fundamentally new detection rules. Indeed, to detect the activity of an LLM agent installed on a host within the infrastructure, it is necessary to create detection logic based on the specific characteristics of the agents. Detection rules for this activity can be found using Hunt Hub with the following filter. However, in the case of the attack described, a different logic applies. The main difference lies in the architecture of the attack itself: the LLM agent was not located within the corporate network perimeter. It operated remotely via a C2 agent, orchestrating actions, and left no traces of its presence in the infrastructure (such as specific API requests to local LLMs or anomalous patterns of resource consumption by hosts). The key difference between this activity and an attack by an experienced human operator lies largely in speed. Tactically, technically, and methodologically, AI, for the most part, uses exactly the same tools, utilities, and techniques as a human penetration tester. It does not write unique exploits from scratch, but rather combines known methods and dynamically adapts them to the situation, handling the tools’ errors on its own. Since the actions performed by an AI agent on the network are indistinguishable from those of a human, classic, well-tuned correlation and behavioral analysis rules are sufficient to detect it. Here are a few examples of how Kaspersky Next EDR Expert successfully detects the attack described: To detect the execution of a malicious script via a remote scheduled task, you need to monitor the creation of the schtasks.exe process with the /s argument. EDR Expert detects this activity using the rules create_task_on_remote_host_using_standard_tool, scheduled_task_creation_as_system_via_schtasks, and scheduled_task_with_powershell_execution. During the attack, the adversary will need access to the victim’s credentials; in the described case, one way to obtain them was through a well-known technique that uses legitimate tools to dump LSASS, specifically by calling the MiniDump function from comsvcs.dll. The EDR Expert solution detects this activity using the rules dumping_memory_with_com_services_dll and suspicious_lsass_memory_access. A significant part of the attack chain is lateral movement, which helps the attacker navigate within the infrastructure and achieve their desired objectives. In the described case, the WinRM protocol is used to initiate connections directly from PowerShell. This is a standard technique that allows the attacker to execute commands on remote machines without using additional network tunnels. The EDR Expert solution detects this activity using the rules using_powershell_for_remote_execution_via_wmi and winrm_send_command. Kaspersky Anti Targeted Attack (KATA) is used to detect malicious activity in network traffic. Communication between CyberStrikeAI agents and the command-and-control server occurs without accessing AI platforms such as ChatGPT or Claude. Instead, the agent’s C2 server is an infrastructure pre-configured by the attackers, just as in attacks that do not use AI agents. Analysis of decrypted network traffic using NDR-class solutions reveals characteristic communication patterns of CyberStrikeAI agent activity. When these patterns are detected, KATA generates an alert with the verdict Backdoor.CyberStrikeAI.HTTP.C&C. Alert regarding the detection of CyberStrikeAI communication with a C2 server To detect post-exploitation activity, you can use not only IDS technology but also NAD (Network Anomaly Detection). It analyzes all traffic for suspicious indicators that do not correspond to a node’s typical network activity. For example, actions performed by CyberStrikeAI during the Domain Discovery phase are detected by an NDR:NAD rule named “Scanning domain records via LDAP queries.” NDR:NAD alert: reconnaissance via LDAP queries detected You can learn more about NDR:NAD technology in our article on Securelist. You can also visualize the connections between C2 addresses and files used by attackers in the Research Graph section of the Kaspersky Threat Intelligence Portal. This includes tracking the emergence of new CyberStrikeAI implants that communicate with malicious addresses. Visualization via the Research Graph on the Kaspersky Threat Intelligence Portal In addition, the Threat Lookup service available on the portal allows you to determine whether malicious files belong to CyberStrikeAI using attribution mechanisms based on the executable file’s code. Demonstration of attributing a malicious implant to the CyberStrikeAI framework Kaspersky SIEM detects all stages of an attack by the CyberStrikeAI agent. The product repository contains over 100 rules for detecting the techniques discussed in this article; we will list the most critical ones below. Execution of various commands from the sqlservr.exe process: R300_04_Windows shell started by a web application Downloading and executing a payload via PowerShell: R110_03_PowerShell code downloaded and executed Creating Windows scheduled tasks: R099_04_Suspicious arguments when running schtasks.exe R300_03_Windows shell started by the scheduler Persisting via crontab or bashrc: R099_06_Suspicious cron job activity R405_02_UNIX shell configuration modification Rules located at the KUMA Packages/SOC package/Configuration discovery path detect the collection of information about hosts, network settings, and domains using various reconnaissance tools. Rules that aggregate detections by reconnaissance tools: R224_14_Windows reconnaissance activity R224_09_System information discovery by running multiple utilities within a short period R224_04_System information discovery via standard Linux tools Data collection for Kerberoasting and AS-REP Roasting: R034_01_Multiple TGS ticket requests (Kerberoasting) R452_18_AS-REP Roasting Dumping registry hives containing credentials using the reg.exe utility: R230_02_Copying data containing credentials from the Windows registry Dumping the lsass.exe process using the MiniDump function of the comsvcs.dll library: R233_04_Process memory dump via comsvcs.dll R262_Suspicious access to the LSASS process DCSync and Golden Ticket attacks using the renamed mimikatz utility: R073_DC Sync attack R450_41_Golden Ticket Attack R100_03_Traces of Mimikatz use via cmd Lateral movement using WMIExec: R460_08_Lateral movement using WMIexec Impacket R460_09_Lateral movement using WMIExec and Impacket For the rules to work, you must configure the SIEM system to receive the relevant events: Process launches (Windows security log – 4688, auditd – execve) and PowerShell commands (4104) User logins to the system (Windows security log – 4624, 4768, 4769) Various object manipulations (Windows security log – 4662, 4663, 4656; auditd – openat) Interaction with shared resources (Windows security log – 5145) Indicators of compromise File-based indicators: CyberStrikeAI Windows Beacon D726A8B4886C636F76CA6D30EF6A6FF4 c:\windows\temp\svchosts.exe 2770562d104391b92b42671c270079bb c:\windows\temp\svcmon32.exe c:\programdata\svcmon32.exe CyberStrikeAI Linux Beacon 09e1da2afa1216ecc55648ec8e122d2a 805B9E4AE74C903787416800999B8418 Tools & Scripts 29EFD64DD3C7FE1E2B022B7AD73A1BA5 C:\Windows\Temp\wdiag2.exe (mimikatz) 74F57B3E897A4960DCDD5B7E8A54F9DF c:\rwx\RogueWinRM.exe 0BBD08AF95F877F1D568B03DE2EB76B4 c:\ProgramData\p1.ps1 (reverse shell PS script) Network indicators: 185.186.245[.]144 C2 for Windows Beacon fastcdn[.]bar C2 for Windows Beacon media.fastcdn[.]bar C2 for Linux Beacon 104.234.26[.]163 C2 for Payload Delivery + Linux Beacon
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces;
The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it the largest cryptocurrency heist on record. In a security alert published Saturday, the agency attributed the attack to TraderTraitor, a North Korean hacking group also tracked as Lazarus Group, Jade Sleet, and APT38, linked to numerous cryptocurrency thefts. "The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the FBI said. This official attribution follows blockchain intelligence firms TRM Labs and Chainalysis, which had already linked the theft to TraderTraitor.
The FBI blames North Korea for stealing $6 billion from Binance and urges crypto firms to block transactions linked to the stolen funds. The FBI has named North Korea as the party behind the theft of more than $6 billion in virtual assets from the crypto exchange Binance, on or about October 29, 2026. The bureau published its findings in a public alert. The FBI specifically blames the North Korea-linked APT “TraderTraitor,” also tracked as Lazarus Group and APT38. Binance hasn’t named a culprit, but the blockchain analysis firm TRM has. It was the first to attribute the attack to TraderTraitor, and Chainalysis also said it’s highly confident in that finding. “The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as “TraderTraitor.”” reads the FBI’s statement. “The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.” Attackers used access from an engineer’s laptop to reach a service container and send unauthorized withdrawal requests. Binance says it has found no evidence that attackers stole any wallet private keys. The FBI, along with the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), has spotted TraderTraitor actors turning the stolen assets mostly into Ethereum (ETH). The agencies expect the next step to be more laundering, by swapping the funds through DeFi and instant swap services as the actors prepare them for later stages. Instant swap services are aptly named. The alert is aimed at private companies as well as law enforcement agencies. The FBI, USSS and IRS-CI are asking several types of businesses to help stop the money laundering. These include THORNode operators, who support the THORChain network, RPC node operators, who provide apps with access to blockchains, instant crypto exchanges, DeFi platforms, blockchain analytics companies and other crypto service providers. The request is clear: these companies should block any transactions involving the wallet addresses used by TraderTraitor, including funds that can be traced back to them. According to the FBI, these addresses have received stolen funds and are controlled by North Korean attackers or are closely linked to them. The full list of addresses is included in the alert. If you run any of these services, the first job is to check your blocklists against that list. The second is to look at transaction flows that touch those addresses indirectly, since the FBI says to block anything “derived from” them, not just direct transfers. Blockchain analytics firms are named for a reason, because tracing derived funds is their work. The FBI says it’s committed to protecting the virtual asset community by identifying, mitigating and disrupting North Korea’s illicit cybercrime and virtual asset theft. “The FBI maintains its commitment to protecting the virtual asset community by identifying, mitigating, and disrupting North Korea’s illicit cybercrime and virtual asset theft activities.” concludes the report. “If you have any information to provide, please contact your local FBI field office or FBI’s Internet Crime Complaint Center at ic3.gov.” TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. “On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.” TRM said. “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.” Freezing the money only went partway. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all. But the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach. The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. Those amounts describe different moments, and you shouldn’t add them without checking whether they cover distinct assets. A freeze works on tokens that have an issuer to call, and Ether and Bitcoin don’t. Below is the link to my interview regarding the Binance case for Italian state television. https://www.youtube.com/watch?v=DtvhBA9TdPo Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Binance)
Confirm this action.
Leaving now will discard your changes.